Re: [Spasm] CAA erratum 4515

[Jacob Hoffman-Andrews <[e-mail]>]

On 03/17/2017 07:39 AM, Phillip Hallam-Baker wrote:
> ​So at this point, does anyone object to the ​following course of action:
>
> ​* Amend the CABForum ​'clarification' ballot to state that CAs must
> implement RFC 6844 as amended by erratum 4515
>
> * Write new ID to accept the substantive change described in Erratum 4515
>
> * Request publication as a new RFC
>
> ​Now whether we do this inside or outside the WG is for the chairs and
> AD to consider. I don't think this is currently a WG item.​ But if we
> have concurrence and there is no real dispute, that probably isn't
> such an issue.
This seems like a reasonable course of action. The only quibble I have
is that, while erratum 4515 is the minimal change to express the
behavior we've agreed to, it leaves the algorithm section overly
detailed in a way that is potentially confusing to readers. I'd like to
propose this version, which relies on the RFC 1034 language for CNAME
resolution in order to clarify the behavior:

----- Proposal -----
   Let CAA(X) be the record set returned by performing a CAA record
query on the domain name X, according to the name server lookup
algorithm specified in RFC 1034 section 4.3.2 (in particular including
CNAME responses). Let P(X) be the domain name produced by removing the
leftmost label of X.

 - If CAA(X) contains any CAA resource records, R(X) = CAA(X), otherwise
 - If P(X) is the root domain '.', then R(X) is empty, otherwise
 - R(X) = R(P(X))

----- End proposal -----
  

For reference, current RFC 6844 with 4515 applied:

   Let CAA(X) be the record set returned in response to performing a CAA
   record query on the label X, P(X) be the DNS label immediately above
   X in the DNS hierarchy, and A(X) be the target of a CNAME or DNAME
   alias record specified at the label X.

   o  If CAA(X) is not empty, R(X) = CAA (X), otherwise

   o  If A(X) is not null, and CAA(A(X)) is not empty, then R(X) =
      CAA(A(X)), otherwise

   o  If X is not a top-level domain, then R(X) = R(P(X)), otherwise

   o  R(X) is empty.

   For example, if a certificate is requested for X.Y.Z the issuer will
   search for the relevant CAA record set in the following order:

      X.Y.Z

      Alias (X.Y.Z)

      Y.Z

      Alias (Y.Z)

      Z

      Alias (Z)

      Return Empty